equip/init: read the selected EF directly, bound the startup drain

pySim's scc.read_binary/read_record call select_path(ef) first, so the
ICCID, network-state, EF.ARR and EF.PBR readers - which had already made a
parent-scoped selection and hold its FCP - sent a second SELECT per file
and per record.  _read_selected_ef() issues READ BINARY (chunked at
max_cmd_len from the FCP file size) / READ RECORD (b2<rec>04<len> at the
FCP record length) directly; the pySim helpers stay as the fallback when
the FCP lacks the value.

The startup TERMINAL PROFILE drain now breaks on the chain's idle SW
instead of polling STATUS once more.

Measured on the last startup: ~3.4 s traced init (netstate/ARR/PBR 271
APDUs / 1.26 s incl. 169 SELECTs; the card's own TP processing 1.58 s);
the change removes ~0.7-0.8 s of the read phase without touching any data
or the TP.

v3.38.1; tests: tests/test_read_selected.py (direct reads, chunking, the
fallback and the drain source pin) and the ARR/PBR/ICCID/netstate fakes.
1067 Python + 1075 frontend.  sw cache simple-v482.

pysim_simple_server/__main__.py

@@ -293,7 +293,11 @@ def main():
                 sys.stderr.write('INIT: drain STATUS -> %s\n' % st_sw)
                 if not st_sw.startswith('91'):
                     break
-                _handle_proactive_chain(scc, st_sw)
+                chain_sw = _handle_proactive_chain(scc, st_sw)
+                # the chain's trailing STATUS already proved the card idle;
+                # polling once more only costs an APDU (v3.38.1)
+                if chain_sw and not chain_sw.startswith('91'):
+                    break
             _tlog('terminal_profile_drain: %.0fms' % ((time.time() - t_phase) * 1000))
         except Exception as e:
             if _is_pcsc_error(e):